CVE-2026-18174 in fastify-forwarded
Summary
by MITRE • 07/29/2026
@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both space and tab. As a result, an entry padded with a tab keeps the literal tab in the resolved address string. Applications that make exact string match security decisions on the resolved client IP, such as an allowlist, a blocklist, a per IP rate limit key, or audit log correlation, can be evaded because the tab corrupted string no longer matches the expected value. This does not cross the trust boundary, since a tab corrupted string is not a valid IP and cannot be mistaken for a trusted proxy. The issue is fixed in @fastify/forwarded 3.0.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
The vulnerability in @fastify/forwarded versions prior to 3.0.2 represents a subtle but significant parsing inconsistency that can undermine security controls relying on client IP address validation. This flaw stems from improper handling of whitespace characters within the X-Forwarded-For header, specifically failing to normalize horizontal tab characters that should be treated as optional whitespace according to RFC 7230. The parser's behavior demonstrates a deviation from established standards where only space characters are trimmed while tab characters persist in the resolved address string, creating a mismatch between expected and actual IP representations.
The technical implementation of this vulnerability occurs during header parsing when multiple comma-separated entries exist within X-Forwarded-For. While the code correctly processes spaces for trimming, it neglects to account for horizontal tabs that may be present as padding around IP addresses. This inconsistency creates a scenario where an attacker can craft malicious requests containing tab-padded IP addresses in the forwarded header, resulting in resolved client addresses that contain literal tab characters. The impact extends beyond simple parsing differences because these tab characters render the resolved IP string incompatible with security mechanisms that perform exact string matching against expected IP values.
Applications utilizing this library for security decisions face substantial operational risks when deployed with vulnerable versions. Security controls such as allowlists, blocklists, rate limiting per IP address, and audit log correlation systems become ineffective because the tab-padded IP addresses no longer match the expected string representations in these security mechanisms. This creates a bypass vector where malicious actors can evade restrictions by simply padding their IP addresses with tabs in the forwarded header, effectively rendering access control measures useless. The vulnerability does not compromise trust boundaries since tab characters make the resulting strings invalid IP addresses that cannot be mistaken for legitimate proxy addresses, but it does undermine the integrity of security enforcement mechanisms.
The fix implemented in @fastify/forwarded version 3.0.2 addresses this by ensuring comprehensive whitespace normalization that includes both space and horizontal tab characters during header parsing. This correction aligns the library's behavior with RFC 7230 standards and restores proper string matching capabilities for security systems relying on exact IP address comparisons. From a cybersecurity perspective, this vulnerability maps to CWE-20 Improper Input Validation and aligns with ATT&CK technique T1071.401 Application Layer Protocol: Web Protocols where attackers manipulate header values to evade detection or access controls. Organizations should prioritize updating to version 3.0.2 or later to prevent potential exploitation of this parsing inconsistency that could allow unauthorized access through bypassed IP-based security measures.